CryptPad 2025.3.1 allows unbounded WebSocket frame flood.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 30, 2026 · NIST NVD

   Detected

   CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.

2. Oct 14, 2026 · NIST NVD

   Updated

   CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.

Affected

• cpe xwiki/cryptpadversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-51846

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-51846

  30-day exploitation probability 0.6%

  first.org
• NIST NVDVulnerability recordCVE-2025-51846

  CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.

  nvd.nist.gov

References

• Exploit · github.com
• Patch · github.com
• Third Party Advisory · raw.githubusercontent.com
• Third Party Advisory · cve.org